spree_core 5.6.1 → 6.0.0.beta2

data/app/models/spree/authentication/strategies/base_strategy.rb

@@ -4,10 +4,51 @@ module Spree
       class BaseStrategy
         attr_reader :params, :request_env, :user_class
 
+        class << self
+          # How a client initiates login with this strategy.
+          #
+          # +:password+ — the client posts credentials to the auth endpoint.
+          # +:redirect+ — the client sends the browser to the identity provider,
+          # which returns through the OAuth callback.
+          #
+          # Defaults to +:password+ so strategies written before provider
+          # discovery existed keep describing themselves correctly.
+          # @return [Symbol]
+          def kind
+            :password
+          end
+
+          # Human-readable provider name for the login button. Only meaningful for
+          # +:redirect+ strategies; defaults to nil so password strategies render
+          # their standard form instead of a button.
+          # @return [String, nil]
+          def label
+            nil
+          end
+        end
+
         def initialize(params:, request_env:, user_class: nil)
           @params = params
           @request_env = request_env
-          @user_class = user_class || Spree.user_class
+          @user_class = user_class || Spree.customer_class
+        end
+
+        # Where to send the browser to begin authentication. Redirect strategies
+        # must implement this; password strategies never call it.
+        #
+        # @param state [String] opaque CSRF token echoed back to the callback
+        # @return [String] the identity provider's authorization URL
+        def authorization_url(state:)
+          raise NotImplementedError, 'Redirect strategies must implement #authorization_url'
+        end
+
+        # Completes a redirect login from the identity provider's callback params.
+        # Redirect strategies must implement this; password strategies use
+        # +#authenticate+ instead.
+        #
+        # @return [Spree::ServiceModule::Result] the resolved user on success
+        def callback
+          raise NotImplementedError, 'Redirect strategies must implement #callback'
         end
 
         # Returns Result object with user on success
@@ -34,9 +75,19 @@ module Spree
           Spree::ServiceModule::Result.new(success: false, error: message)
         end
 
-        # Find user by email
+        # Looks a user up by email, case-insensitively.
+        #
+        # The models validate email uniqueness with +case_sensitive: false+ but
+        # normalize with +squish+ only, so a stored "Ada@Example.com" is the same
+        # account as "ada@example.com" — an exact match would refuse login to
+        # someone who capitalizes their own address differently.
+        #
+        # @param email [String]
+        # @return [Object, nil]
         def find_user_by_email(email)
-          user_class.find_by(email: email)
+          return nil if email.blank?
+
+          user_class.find_by(user_class.arel_table[:email].lower.eq(email.to_s.downcase))
         end
 
         # Find or create user identity

data/app/models/spree/authentication/strategies/email_password_strategy.rb

@@ -11,10 +11,18 @@ module Spree
 
           user = find_user_by_email(email)
           return failure('Invalid email or password') unless user
+          return failure('Account temporarily locked. Try again later.') if user.respond_to?(:locked?) && user.locked?
 
           if validate_password(user, password)
+            # Require the full lockout contract before touching the counter — a
+            # custom customer_class may implement one hook but not the other.
+            if user.respond_to?(:failed_attempts) && user.respond_to?(:reset_failed_attempts!) &&
+               user.failed_attempts.to_i.positive?
+              user.reset_failed_attempts!
+            end
             success(user)
           else
+            user.record_failed_attempt! if user.respond_to?(:record_failed_attempt!)
             failure('Invalid email or password')
           end
         rescue => e
@@ -29,14 +37,14 @@ module Spree
         private
 
         def validate_password(user, password)
-          # Try Devise's valid_password? method first (most common)
+          # Duck-typed so any customer_class works: prefer valid_password?
+          # (defined by the gem models and legacy/custom models alike), then
+          # fall back to has_secure_password's authenticate.
           if user.respond_to?(:valid_password?)
             user.valid_password?(password)
-          # Fallback to authenticate method (for has_secure_password)
           elsif user.respond_to?(:authenticate)
             user.authenticate(password).present?
           else
-            # No password authentication available
             Rails.logger.warn "User class #{user.class} does not implement password authentication"
             false
           end

data/app/models/spree/authentication/strategies/oidc_strategy.rb

@@ -0,0 +1,330 @@
+require 'net/http'
+
+module Spree
+  module Authentication
+    module Strategies
+      # Generic OpenID Connect strategy — the reference SSO provider.
+      #
+      # Configured by issuer rather than by seller, so one class covers Microsoft
+      # Entra ID, Okta, Google Workspace, Keycloak and Auth0. Endpoints and signing
+      # keys are read from the issuer's discovery document
+      # (+.well-known/openid-configuration+), so nothing seller-specific is hardcoded.
+      #
+      # Registered as a configured factory, which lets the same class back several
+      # providers with different issuers:
+      #
+      #   Spree.admin_authentication_strategies.add(
+      #     :entra,
+      #     Spree::Authentication::Strategies::OidcStrategy.configure(
+      #       issuer: 'https://login.microsoftonline.com/<tenant>/v2.0',
+      #       client_id: ENV['ENTRA_CLIENT_ID'],
+      #       client_secret: ENV['ENTRA_CLIENT_SECRET'],
+      #       redirect_uri: 'https://shop.example.com/api/v3/admin/auth/callback/entra',
+      #       label: 'Microsoft Entra ID'
+      #     )
+      #   )
+      class OidcStrategy < BaseStrategy
+        # Configured registry entry. Holds provider settings and builds a strategy
+        # instance per request, mirroring the class-level interface the registry
+        # reads for discovery (+kind+, +label+, +authorization_url+).
+        class Factory
+          attr_reader :config
+
+          def initialize(config)
+            @config = config
+          end
+
+          def build(params:, request_env:, user_class: nil)
+            OidcStrategy.new(
+              params: params,
+              request_env: request_env,
+              user_class: user_class,
+              config: config
+            )
+          end
+
+          def kind
+            :redirect
+          end
+
+          def label
+            config[:label]
+          end
+
+          # Reuses one request-less strategy for URL building. The factory lives
+          # for the process lifetime, so its discovery-document memo survives
+          # across requests — a fresh instance per call would re-read the cache
+          # (a DB query under solid_cache) on every login-page load.
+          def authorization_url(state:)
+            @url_builder ||= OidcStrategy.new(params: {}, request_env: {}, config: config)
+            @url_builder.authorization_url(state: state)
+          end
+        end
+
+        REQUIRED_OPTIONS = %i[issuer client_id client_secret redirect_uri].freeze
+
+        # Builds a registry entry for one identity provider.
+        #
+        # @param issuer [String] OIDC issuer URL (discovery is read from it)
+        # @param client_id [String]
+        # @param client_secret [String]
+        # @param redirect_uri [String] must match the value registered with the IdP
+        # @param label [String] name shown on the dashboard login button
+        # @param scope [String] space-separated scopes; must include +openid+
+        # @param trust_unverified_email [Boolean] allow first-login account linking
+        #   when the provider omits the +email_verified+ claim. Off by default.
+        #   Only enable for a provider whose directory owns its email addresses —
+        #   Microsoft Entra ID omits the claim for work accounts, for instance, and
+        #   a tenant admin controls those addresses. Never enable it for a provider
+        #   where a person can set their own email (a consumer Google or GitHub
+        #   account), since that turns "claim any staff address" into a takeover.
+        # @return [Factory]
+        def self.configure(issuer:, client_id:, client_secret:, redirect_uri:, label: nil, scope: 'openid email profile',
+                           trust_unverified_email: false)
+          config = {
+            issuer: issuer.to_s.chomp('/'),
+            client_id: client_id,
+            client_secret: client_secret,
+            redirect_uri: redirect_uri,
+            label: label,
+            scope: scope,
+            trust_unverified_email: trust_unverified_email
+          }
+
+          missing = REQUIRED_OPTIONS.select { |option| config[option].blank? }
+          raise ArgumentError, "OidcStrategy is missing required options: #{missing.join(', ')}" if missing.any?
+
+          # Derived once — the issuer is fixed for the life of a registration.
+          config[:cache_key_prefix] = "spree/oidc/#{Digest::SHA256.hexdigest(config[:issuer])}"
+
+          Factory.new(config)
+        end
+
+        attr_reader :config
+
+        def initialize(params:, request_env:, user_class: nil, config: {})
+          super(params: params, request_env: request_env, user_class: user_class)
+          @config = config
+        end
+
+        def provider
+          :oidc
+        end
+
+        # Where to send the browser to begin login.
+        # @param state [String] opaque CSRF token echoed back to the callback
+        # @return [String]
+        def authorization_url(state:)
+          query = {
+            client_id: config[:client_id],
+            response_type: 'code',
+            scope: config[:scope],
+            redirect_uri: config[:redirect_uri],
+            state: state
+          }
+
+          "#{discovery_document.fetch('authorization_endpoint')}?#{query.to_query}"
+        end
+
+        # Password login is not available through an OIDC provider — the browser
+        # redirect is the only entry point.
+        def authenticate
+          failure(Spree.t('errors.messages.oidc_requires_redirect'))
+        end
+
+        # Completes the login started by +#authorization_url+: exchanges the
+        # authorization code for an ID token, verifies it, and resolves the claims
+        # to a user.
+        # @return [Spree::ServiceModule::Result]
+        def callback
+          code = params[:code]
+          return authentication_failure(Spree.t('errors.messages.oidc_missing_code')) if code.blank?
+
+          claims = verify_id_token(exchange_code_for_tokens(code).fetch('id_token'))
+          resolve_user(claims)
+        rescue StandardError => e
+          Rails.logger.error("[Spree] OIDC callback failed for #{config[:label] || config[:issuer]}: #{e.message}")
+          authentication_failure(Spree.t('errors.messages.oidc_authentication_failed'))
+        end
+
+        # True when the last +#callback+ failed because no account here is
+        # authorized for an otherwise-authenticated IdP subject, as opposed to a
+        # technical failure (missing code, token verification). The two carry
+        # different error codes and very different advice for the person.
+        # @return [Boolean]
+        def account_not_provisioned?
+          @account_not_provisioned.present?
+        end
+
+        private
+
+        # Resolves verified IdP claims to a user, in three steps:
+        #
+        # 1. a known identity logs in;
+        # 2. an existing account with the same **verified** email adopts the
+        #    identity — this is what lets a shop switch on SSO without making
+        #    existing staff log in with a password first;
+        # 3. anything else is rejected. Admin accounts never auto-provision, or
+        #    every member of a corporate tenant would become store staff.
+        def resolve_user(claims)
+          subject = claims['sub']
+          return authentication_failure(Spree.t('errors.messages.oidc_authentication_failed')) if subject.blank?
+
+          identity = Spree::UserIdentity.find_by(
+            provider: registry_key,
+            uid: subject,
+            user_type: user_class.name
+          )
+          return success(identity.user) if identity
+
+          user = find_linkable_user(claims)
+          return not_provisioned_failure if user.nil?
+
+          user.identities.create!(provider: registry_key, uid: subject, info: identity_info(claims))
+          success(user)
+        end
+
+        def authentication_failure(message)
+          @account_not_provisioned = false
+          failure(message)
+        end
+
+        def not_provisioned_failure
+          @account_not_provisioned = true
+          failure(Spree.t('errors.messages.oidc_account_not_provisioned'))
+        end
+
+        # Only an email the provider asserts as verified may claim an existing
+        # account. Matching on an unverified claim would let anyone who can set
+        # their IdP email to a staff address take that account over.
+        #
+        # Some directories — Microsoft Entra ID among them — omit +email_verified+
+        # for work accounts, which would block first-login linking for every
+        # existing admin. Those providers opt in with +trust_unverified_email+; an
+        # explicitly false claim is still refused either way.
+        def find_linkable_user(claims)
+          return nil unless email_claim_trusted?(claims)
+
+          # find_user_by_email matches case-insensitively, which matters here: the
+          # models normalize email with +squish+ but never downcase, so a stored
+          # "Ada@Example.com" must still link to a lowercased IdP claim.
+          find_user_by_email(claims['email'])
+        end
+
+        # A present claim is always obeyed: "false" refuses linking even when the
+        # provider is configured as trusted. Only an *absent* claim falls back to
+        # the provider's configuration.
+        def email_claim_trusted?(claims)
+          verified = claims['email_verified']
+
+          return verified.to_s == 'true' unless verified.nil?
+
+          config[:trust_unverified_email].present?
+        end
+
+        def identity_info(claims)
+          claims.slice('email', 'name', 'gisel_name', 'family_name', 'picture')
+        end
+
+        # The key this provider is registered under — used as UserIdentity#provider
+        # so two OIDC providers on one store stay distinct.
+        def registry_key
+          params[:provider].presence || provider.to_s
+        end
+
+        def exchange_code_for_tokens(code)
+          response = post_form(
+            discovery_document.fetch('token_endpoint'),
+            grant_type: 'authorization_code',
+            code: code,
+            redirect_uri: config[:redirect_uri],
+            client_id: config[:client_id],
+            client_secret: config[:client_secret]
+          )
+
+          raise "token endpoint returned #{response.code}" unless response.is_a?(Net::HTTPSuccess)
+
+          JSON.parse(response.body)
+        end
+
+        # Verifies signature, issuer and audience. Skipping any of these would let
+        # a token minted for another application authenticate here.
+        def verify_id_token(id_token)
+          claims, = JWT.decode(
+            id_token,
+            nil,
+            true,
+            algorithms: discovery_document.fetch('id_token_signing_alg_values_supported', ['RS256']),
+            iss: config[:issuer],
+            verify_iss: true,
+            aud: config[:client_id],
+            verify_aud: true,
+            jwks: jwks
+          )
+
+          claims
+        end
+
+        # A loader proc rather than a fetched set: the jwt gem re-invokes it with
+        # +invalidate: true+ when a token's key id is missing from the cached set,
+        # so signing keys are cached like the discovery document yet still pick up
+        # provider key rotation on the next login.
+        def jwks
+          lambda do |options|
+            Rails.cache.delete(jwks_cache_key) if options[:invalidate]
+
+            JWT::JWK::Set.new(
+              Rails.cache.fetch(jwks_cache_key, expires_in: 12.hours) do
+                JSON.parse(http_get(discovery_document.fetch('jwks_uri')))
+              end
+            )
+          end
+        end
+
+        def jwks_cache_key
+          "#{cache_key_prefix}/jwks"
+        end
+
+        def discovery_document
+          @discovery_document ||= Rails.cache.fetch("#{cache_key_prefix}/discovery", expires_in: 12.hours) do
+            JSON.parse(http_get("#{config[:issuer]}/.well-known/openid-configuration"))
+          end
+        end
+
+        def cache_key_prefix
+          config[:cache_key_prefix]
+        end
+
+        # Short timeouts because provider discovery runs on the unauthenticated
+        # login-page endpoint: Net::HTTP's 60s defaults would let one unreachable
+        # identity provider pin a request thread for a minute per call.
+        OPEN_TIMEOUT = 2
+        READ_TIMEOUT = 5
+
+        def http_get(url)
+          uri = URI(url)
+          response = http_client(uri).request(Net::HTTP::Get.new(uri))
+          raise "#{url} returned #{response.code}" unless response.is_a?(Net::HTTPSuccess)
+
+          response.body
+        end
+
+        def post_form(url, **form_data)
+          uri = URI(url)
+          request = Net::HTTP::Post.new(uri)
+          request.set_form_data(form_data)
+
+          http_client(uri).request(request)
+        end
+
+        def http_client(uri)
+          Net::HTTP.new(uri.host, uri.port).tap do |client|
+            client.use_ssl = uri.scheme == 'https'
+            client.open_timeout = OPEN_TIMEOUT
+            client.read_timeout = READ_TIMEOUT
+          end
+        end
+      end
+    end
+  end
+end

data/app/models/spree/authentication/strategy_registry.rb

@@ -17,6 +17,23 @@ module Spree
     #
     # @example Reading a strategy class
     #   Spree.store_authentication_strategies[:email]
+    #
+    # An entry may be either a strategy **class** or a configured **factory** —
+    # any object responding to +#build(params:, request_env:, user_class:)+.
+    # Factories let one class serve several registrations with different settings
+    # (an OIDC strategy pointed at two different issuers, say), which a bare class
+    # cannot express.
+    #
+    # @example Registering a configured factory
+    #   Spree.admin_authentication_strategies.add(
+    #     :entra,
+    #     Spree::Authentication::Strategies::OidcStrategy.configure(
+    #       issuer: 'https://login.microsoftonline.com/<tenant>/v2.0',
+    #       client_id: ENV['ENTRA_CLIENT_ID'],
+    #       client_secret: ENV['ENTRA_CLIENT_SECRET'],
+    #       label: 'Microsoft Entra ID'
+    #     )
+    #   )
     class StrategyRegistry
       extend Forwardable
       include Enumerable
@@ -67,6 +84,72 @@ module Spree
       def to_h
         @strategies.dup
       end
+
+      # Instantiates the strategy registered under +key+, accepting either a bare
+      # class or a configured factory.
+      #
+      # @param key [Symbol, String] provider identifier
+      # @return [Object, nil] a strategy instance, or nil if no such key
+      def build(key, params:, request_env:, user_class: nil)
+        entry = self[key]
+        return nil if entry.nil?
+
+        if entry.respond_to?(:build)
+          entry.build(params: params, request_env: request_env, user_class: user_class)
+        else
+          entry.new(params: params, request_env: request_env, user_class: user_class)
+        end
+      end
+
+      # Self-description of every registered strategy, for the provider-discovery
+      # endpoint that drives the dashboard login page.
+      #
+      # Exposes only what a login screen needs — never client secrets, never
+      # strategy class names.
+      #
+      # @return [Array<Hash>] one entry per registered provider
+      # @yieldparam key [Symbol] provider key, for minting a per-provider CSRF state
+      # @return [Array<Hash>] one entry per registered provider
+      def describe
+        @strategies.map do |key, entry|
+          kind = kind_of(entry)
+          descriptor = { key: key.to_s, kind: kind.to_s }
+          descriptor[:label] = label_of(entry)
+
+          if kind == :redirect
+            state = block_given? ? yield(key) : nil
+            descriptor[:authorization_url] = authorization_url_for(entry, state: state)
+          end
+
+          descriptor.compact
+        end
+      end
+
+      private
+
+      # Registry entries predate the kind/label contract — a strategy registered
+      # before it existed (or one that does not inherit BaseStrategy) must not
+      # raise here, because describe backs the unauthenticated login page and one
+      # bad entry would take down sign-in for everyone.
+      def kind_of(entry)
+        entry.respond_to?(:kind) ? entry.kind.to_sym : :password
+      end
+
+      def label_of(entry)
+        return nil unless entry.respond_to?(:label)
+
+        entry.label.presence
+      end
+
+      # A misconfigured provider (bad issuer, unreachable discovery document)
+      # must not take down the whole login page — it drops out of the list
+      # instead, leaving the remaining providers usable.
+      def authorization_url_for(entry, state:)
+        entry.authorization_url(state: state)
+      rescue StandardError => e
+        Rails.logger.error("[Spree] Could not build authorization URL for #{label_of(entry) || entry}: #{e.message}")
+        nil
+      end
     end
   end
 end

data/app/models/spree/base.rb

@@ -6,11 +6,33 @@ class Spree::Base < ApplicationRecord
   include Spree::IntegrationsConcern
   include Spree::Publishable
   include Spree::PrefixedId
+  include Spree::HasNumber
+  include Spree::HasIsoGeography
   include Spree::TypedAssociations
+  include Spree::ValidatesStoreUniqueness
 
+  # Extra writable attributes contributed by extensions, appended to the v3
+  # controller allowlist for this resource. Core attributes belong in the
+  # controller's own list — this exists so an extension that adds a column can
+  # make it writable without decorating a controller:
+  #
+  #   Spree::Product.additional_permitted_attributes += [:brand_id]
+  #
+  # Entries are `params.permit` fragments: bare symbols, or hashes for
+  # collections and nested structures (`{ region_ids: [] }`). Append with `+=`
+  # rather than assigning, so extensions don't clobber each other.
+  class_attribute :additional_permitted_attributes, instance_writer: false, default: [].freeze
+
+  # Backfills preferences added to the class after this row was last saved, so
+  # a reader never sees nil for a newly defined preference. Assigning
+  # unconditionally would dirty every record on load: `preferences` is a
+  # YAML-serialized Hash, so the dirty check compares the serialized string and
+  # the merge reorders keys even when nothing changed — which is enough to make
+  # `with_lock` refuse the record ("unpersisted changes").
   after_initialize do
     if has_attribute?(:preferences) && !preferences.nil?
-      self.preferences = default_preferences.merge(preferences)
+      missing = default_preferences.except(*preferences.keys)
+      self.preferences = preferences.merge(missing) if missing.any?
     end
   end
 
@@ -27,10 +49,6 @@ class Spree::Base < ApplicationRecord
     select("#{klass.table_name}.*").select(*(fields || klass::TRANSLATABLE_FIELDS))
   }
 
-  def self.belongs_to_required_by_default
-    false
-  end
-
   def self.for_store(store)
     plural_model_name = model_name.plural.gsub(/spree_/, '').to_sym
 
@@ -49,22 +67,21 @@ class Spree::Base < ApplicationRecord
     ApplicationRecord.try(:spree_base_uniqueness_scope) || []
   end
 
-  # FIXME: https://github.com/rails/rails/issues/40943
-  def self.has_many_inversing
-    false
-  end
-
   # this can overridden in subclasses to disallow deletion
   def can_be_deleted?
     true
   end
 
+  # @see Spree.mysql? — the single definition; this reads it so a model can
+  #   branch without reaching for the connection itself.
   def mysql_adapter?
-    ActiveRecord::Base.connection.adapter_name.downcase.include?('mysql')
+    Spree.mysql?
   end
 
   def self.json_api_columns
-    column_names.reject { |c| c.match(/_id$|id|preferences|(.*)password|(.*)token|(.*)api_key|^original_(.*)/) }
+    # `_type` goes with `_id`: the two halves of a polymorphic reference name
+    # an internal class, which is no more public than the key beside it.
+    column_names.reject { |c| c.match(/_id$|id|_type$|preferences|(.*)password|(.*)token|(.*)api_key|^original_(.*)/) }
   end
 
   def self.json_api_permitted_attributes
@@ -127,7 +144,61 @@ class Spree::Base < ApplicationRecord
     type.to_s.demodulize.underscore
   end
 
+  # Prefixed id for a polymorphic reference, encoded from the columns without
+  # loading the row.
+  #
+  # Reads both halves together so a type never appears beside a null id: the
+  # pair names something a client can link to, or neither does. Answers nil for
+  # a model without `has_prefix_id` — an extension may point a polymorphic
+  # column at one, and one such row must not 500 the whole list.
+  #
+  # @param type [String, nil] the polymorphic `*_type` column
+  # @param id [Integer, String, nil] the polymorphic `*_id` column
+  # @return [String, nil]
+  def self.polymorphic_prefixed_id(type, id)
+    return nil if type.blank? || id.blank?
+
+    type.to_s.safe_constantize.try(:prefixed_id_for, id)
+  end
+
+  # Reads the arguments of a two-state ransackable scope — one that answers a
+  # question with two named sides ("erased" / "not erased", "outstanding" /
+  # "spent") rather than narrowing to a value.
+  #
+  # Declare such a scope as `->(*values)`, never `->(value = true)`. Ransack
+  # calls one of three ways, and only a splat survives all of them:
+  #
+  # - a literal boolean `true` invokes the scope with NO arguments, which
+  #   means the affirmative side (this is why an empty list reads as `true`);
+  # - a single value arrives as that value;
+  # - an array predicate is SPLATTED, so a filter offering both sides passes
+  #   two arguments and a fixed-arity lambda raises ArgumentError — a 500 on a
+  #   request the merchant is entitled to make. Asking for every side is no
+  #   constraint at all, which is the `nil` below.
+  #
+  # The scope must also be listed in the model's
+  # `ransackable_scopes_skip_sanitize_args`, or Ransack casts `false` itself
+  # and then declines to apply the scope at all.
+  #
+  # @param values [Array<Object>] whatever Ransack passed through
+  # @return [Boolean, nil] the side asked for, or nil when every side was
+  def self.ransack_flag(*values)
+    # No argument is Ransack's shorthand for the affirmative side, not an
+    # absent filter: `q[erased]=true` reaches the scope with nothing at all.
+    return true if values.empty?
+
+    flags = Array(values).flatten.map { |value| ActiveModel::Type::Boolean.new.cast(value) }.uniq
+    # `size == 1`, not `one?`: the latter counts truthy elements, so a lone
+    # `false` would read as "no side chosen" and drop the filter.
+    return nil unless flags.size == 1
+
+    flags.first
+  end
+
+  # @deprecated Legacy Tom Select helper for the removed Rails admin. No replacement.
   def self.to_tom_select_json
+    Spree::Deprecation.warn('Spree::Base.to_tom_select_json is deprecated and will be removed in Spree 6.1.')
+
     pluck(:name, :id).map do |name, id|
       {
         id: id,

data/app/models/spree/base_analytics_event_handler.rb

@@ -24,7 +24,7 @@ module Spree
 
     # Handles the event
     # @param event_name [String] eg. 'order_completed'
-    # @param properties [Hash] eg. { product: Spree::Product, taxon: Spree::Taxon, query: String }
+    # @param properties [Hash] eg. { product: Spree::Product, taxon: Spree::Category, query: String }
     # rubocop:disable Lint/UnusedMethodArgument
     def handle_event(event_name, properties = {})
       raise NotImplementedError, 'Subclasses must implement the handle method'